{"id":"CVE-2025-15679","title":"Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.","summary":"Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.","severity":"high","cvss":7.3,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/S:P/AU:N/R:U/V:C/RE:L/U:Clear","cwe":["CWE-258"],"vendor":"Bull","product":"BullSequana XH3406","affected":["bullsequana_xh3406 < TS 04.05","bullsequana_xh3515 < TS 43.01"],"published":"2026-09-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T16:17:04.560","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15679","references":[{"url":"https://myatos.my.site.com/psmcustomer/s/contentdocument/069ci00000eNzLYAA0","label":"5bcc34ac-0282-4e8a-96fc-046c583d3048"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-11T15:23:45.592824Z"},"cvssSource":"cna","epss":0.00111,"epssPercentile":0.01495,"ingestedAt":"2026-09-11T11:32:42.768Z","slug":"CVE-2025-15679","body":"## Overview\n\nUnder certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}